Load/Write a private key

[AurelienGoor]

I'm using an ESP32-S3 WROOM 1 flashed with Pico-HSM 5.6 firmware. I generated a 2048-bit RSA key on my computer and I want to import it into the Pico-HSM.
The Pico-HSM was initialized with the pico-hsm-tool.py script.
The private key was exported in binary format (DER).

To do this, I run the following command:
pkcs11-tool --login --pin 123456 --write-object private_key.der --type privkey --id 1

Result:

Using slot 0 with a present token (0x0)
error: PKCS11 function C_CreateObject failed: rv = CKR_FUNCTION_NOT_SUPPORTED (0x54)
Aborting.

Is writing the private key supported or did I do something wrong?

[polhenarejos]

It's not possible to import plain private keys for security reasons. The only way to import is via wrapping it through the smart card shell 3.

[AurelienGoor]

Thank you for these details. I followed the documentation doc/scs3.md to load the private key with scs3 but the "Device authentication failed", probably related to the issue #87.

PS : Thanks for this project, which allows to have a low-cost HSM/FIDO device.

[polhenarejos]

Try adding

ESPICOHSMCA00002: new CVC(new ByteString("7F218201BA7F4E8201725F290100421045535049434F48534D434130303030327F4982011D060A04007F000702020202038120FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F822000000000000000000000000000000000000000000000000000000000000000008320000000000000000000000000000000000000000000000000000000000000000784410479BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B88520FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141864104FD4DDCD165DD64494F5F1DB76CDAE4E6BD10DA59BF6D48B684E9D50BCC4C2114D2A8BC7C9C1ACAA24C982B1383D4D02E0F32323F657E146E8A051DEB7F6CD40C8701015F201045535049434F48534D434130303030327F4C12060904007F0007030102025305C0000000045F25060205000400065F24060308000302065F3740472AA7A7945F6352F8A65388C2810AEFB657356FFD31CBB2FCC516BC4ECC953D0BACA935B22D73F49802DD9E9DE6439FD8AEA18BD71E1439ABF458C085BD70C8", HEX))

[AurelienGoor]

it works, thanks a lot